Vulnerability in Fortinet Fortios
CVE-2025-55018
An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header
Vulnerability class: HTTP Request Smuggling
EPSS: 0.004 (27.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N.
Affected products
- Fortinet Fortios — versions 7.6.0, 7.4.0, 7.2.0
Weakness classification (CWE)
References
- psirt@fortinet.com (Vendor Advisory)
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Frequently asked questions
- What is CVE-2025-55018?
- CVE-2025-55018 is a medium-severity vulnerability in Fortinet Fortios, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 5.8/10. Published 2026-02-10.
- How severe is CVE-2025-55018?
- Medium severity. CVSS v3 base score is 5.8 out of 10.